A " quantum public key " based cryptographic scheme for continuous variables 
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By analogy to classical cryptography, we develop a "quantum public key" based cryptographic 
scheme in which the two public and private keys consist in each of two entangled beams of squeezed 
light. An analog message is encrypted by modulating the phase of the beam sent in public. The 
knowledge of the degree of non classical correlation between the beam quadratures measured in 
private and in public allows only the receiver to decrypt the message. Finally, in a view towards 
absolute security, we formally prove that any external intervention of an eavesdropper makes him 
vulnerable to any subsequent detection. 

PACS numbers: 3.67.Dd, 3.67.Hk, 42.50, 42.65.-k 
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Quantum correlations (entanglement) between light 
beams is a subject of considerable activity leading to 
novel applications such as quantum cryptography, quan- 
tum computation and quantum teleportation. As an al- 
ternative to classical cryptography, quantum cryptogra- 
phy methods based on correlation of a single photon pair 
|jj have been widely studied over the past years. They 
have lead to protocoles permitting to transmit confiden- 
tial messages safely |[ ||. On the other hand, few 
results have been presented for systems with a large num- 
ber of photons such as correlated quadratures || |[ 0. 
The use of intense photons beams could present numer- 
ous technological avantages in comparison to the use of 
single photons pulses. Photon counting detectors are 
much more efficient to detect squeezed light [gj and its 
transmission through an optical fiber can be done over a 
much longer distance Q. 

In particular, Pereira et al. § have proposed a scheme 
in which a coherent light beam containing the message is 
transmitted through an adequate superimposition with 
two entangled beams of squeezed light. Since each of the 
two entangled beams is a noisy channel, they need to 
be recombined in order to decrypt the message. In this 
approach, the noise is used to hide the message which 
becomes thus unreadable during the transmission. 

Based on similar considerations, we aim at developping 
a "quantum public key" based cryptographic scheme. 
The public key method |j| is widely used nowadays 
in classical cryptography. It consists in two keys. The 
first key is public and known to everybody i.e. to the 
sender (Alice) and the receiver (Bob) of the message and 
a possible undesirable third party. On the contrary, the 
second key is private and known only by the receiver of 
the message. The procedure is the following: Bob sends 
the public key to Alice who uses it to encrypt the mes- 
sage; then Alice sends back the encrypted information to 
Bob who is the only one able to decrypt it thanks to the 
private key. In this scheme, the essential idea is that the 
encryption is public in the sense that anyone, including 
a third party, can encrypt a message but any decryp- 
tion process must require necessarily the knowledge of 



the second key. In this manner, messages are transmit- 
ted through public channel with strict confidentiality. 

In this letter, we investigate theoretically a quantum 
public key scheme similar to the classical one. We de- 
vice a scheme in which the "q-private" and "q-public" 
keys consist in each of the two entangled photon beams 
respectively. We analyse a process to encrypt an analog 
message using the "q-public" light beam. The confiden- 
tiality of the message is guaranteed since the second "q- 
private" light beam is needed for the decryption process. 
The prefix "q-" has been added to remind the quantum 
character of the signal produced which, to the contrary of 
a classical signal, cannot be necessarily reproduced. The 
non-cloning theorem indeed prevents making an exact 
copy of an unknown quantum signal. Thus, the q-public 
beam is accessible only to any first user including a third 
party. 

The non-cloning theorem is also the basic idea from 
which one can prove that the transmission is secure 
against an eavesdropper (Eve) ||, ||, Q. The impossi- 
bility of reproduction prevents Eve from having access to 
any quantum state without modifying it. Such a mod- 
ification makes her vulnerable to any subsequent detec- 
tion by the sender and/or the receiver. As far as secu- 
rity is concerned, we formally prove for the first time, to 
our knowledge, the vulnerability of an eavesdropper to 
any external intervention during a communication pro- 
cess using continuous variables. However, we point out 
that this result does not imply the absolute security of 
the transmission since the vulnerability of Eve does not 
mean that she will be necessarily detected. An appro- 
priated protocol of communication is required to detect 
that eavesdropping has occured. This essential issue is 
not completely discussed in this letter and remains still 
open in the case of continuous variables. 

Let us start with the description of the quantum public 
key based scheme. Suppose that Alice wishes to send a 
message to Bob. To this purpose, Bob produces an EPR 
state consisting of two entangled beams characterized by 
the photon annihilation operators Si and hi Written 
in occupation photon number representation, this state 
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has the form: 

oo 

I*} = exp(ra\al - raia 2 )|0)i|0) 2 =^ f c n \n) 1 \n}2 (1) 

n=0 

where c„ = (tanhr)"/ coshr and r is the squeezing real 
parameter. Bob then sends beam 1 to Alice and keeps 
beam 2 in his laboratory. Since Bob has access to the 
beam 2, he is the only one able to carry out any mea- 
surement on the total wave function (|l|). Alice or Eve, 
however, is restricted to carry out a measurement of any 
observable concerning the subsystem of the beam 1 . All 
the information available to them is extracted only from 
the diagonal density matrix resulting from the partial 
trace of the total wave function over the unknown beam 
2: 

OO 

px = Tr 2 (|*)<*|) = J2 Kl 2 ! 71 )! i< n l ( 2 ) 

n=0 

With the "q-public" beam received from Bob, Alice en- 
crypts the secret message by making a unitary transfor- 
mation M which modifies the total wave function but not 
the density matrix. Consequently, M should verify the 
following criteria: 

Ml*) + |*) (3) 
MpiM f = pt (4) 

Then Alice sends the beam 1 back to Bob which, thanks 
to the second "q-private" beam is the only one to decrypt 
the message. Another alternative is that Alice carries out 
some measurement herself on the beam 1 and sends the 
results to Bob through a public classical channel. The use 
of such a classical public channel avoids the blockability 
of the system by Eve and thus is secure against a split- 
universe attack Jlpfl . Since the density matrix has not 
been alterated in the encryption process, one does not 
observe the presence of the message in the signal received 
by Bob. 

Among the many existing possibilities, the phase trans- 
formation: 

M = exp (V(alai)) (5) 

satisfies both criteria (||) and f(x) could be any 

real function. For convenience, we choose a simple lin- 
ear function f(x) = 9x which transforms the coefficients 
c n — » exp(i9n)c n . The constant 9 is the analog quantity 
containing the message that Alice encrypts. In compar- 
ison with ||, in our encryption process, the message is 
really "invisible" in the signal and thus cannot be distin- 
guished from the noise. 

After the phase transformation, the field operator as- 
sociated to the first beam becomes ay = Ma\M' — 
exp(— i9)a\. An efficient way to decrypt the informa- 
tion is to measure observables for which the EPR state 



is an eigenstate. Because of the difficulty to get access to 
some of them in experiment, one uses rather the quadra- 
ture components operators: 

Zy = a v e~ l<l > A +a\,e l ' t ' A =e- l8A a 1 +e WA a\ (6) 
Z 2 = e- i9B a 2 + e lt>B 4 , (7) 

where 9 a = 'Pa +0. 4>a and 9 b are the phases of the local 
oscillators used by Alice and Bob, respectively, in their 
homodyne measurements and determine which quadra- 
ture they select for their measurements. 9b must remain 
private to Bob whereas (\>a must be communicated in 
public to Bob at some stage of the protocol. 

Although the EPR state is not an eigenstate of these 
operators, the uncertainty in the quadrature difference 
Z_ = Zy — Z 2 is close to zero as the squeezing parameter 
r becomes large and 9a + 9b = 0. We notice indeed from 
the expression (Q) that: 

{^\8 2 Z-YS>) = 2[cosh2r-cos(6U + 0s)sinh2r](8) 

r>>1 A ■ ■ %{6a + Qb) ,„n 

— > 4smh2rsm (9) 

On the other hand, the introduction of non opposite 
phases 9a + 9b ^ generates for large r a quantum un- 
certainty which appears under the form of fluctuations 
during the measurement of the quadrature difference. In 
this manner, the message is obtained by determining the 
intensity of the noise resulting from these fluctuations 

s 

Fig.|l| depicts a possible setup. The two EPR "q- 
private" and "q-public" beams are generated through 
a nondegenerate parametric down conversion process. 
They result from the fluorescence of a pump beam pass- 
ing through a type II crystal acting also as an optical 
parametric amplifier (OPA) || [ll], [l2[ |l3| . The quadra- 
tures components are measured in a homodyne detection 
with the help of local oscillators fields (LO). The pump 
field, which generates the two EPR beams via parametric 
down conversion, is obtained by one intermediate second 
harmonic (SHG) step as usually. While Bob carries out 
the homodyne detection of one quadrature of beam 2 for 
phase 9b, Alice encrypts the message 9 by modulating 
the beam 1 phase (e.g. by means of an electro-optical 
modulator), before carrying out the measurement of the 
quadrature <f>A- Finally, Alice sends back to Bob the re- 
sults of her measurement through a public classical chan- 
nel. 

Let us now discuss the matter of the vulnerability of 
Eve to any subsequent detection by Alice and/or Bob. 
Let Zy and Z 2 be the observables measured by Alice 
and Bob respectively. Suppose that Eve tries to have 
access to the "q-public" beam 1 and thus modifies it by 
means of an unitary transformation: 

a 1E = U^aiU (10) 
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The unitary operator U could depend on other external 
degrees of freedom (observables) introduced by Eve. For 
example, Eve could use another photon beam or other 
modes of the same beam but taken at a different time or 
even a detector in view of a measurement on the beam 
1. We denote by \v) a basis of the Hilbert space char- 
acterizing these external degrees of freedom and assume 
that |0) is the initial state before the modification. Then 



the state after the unitary transformation is C/|W)|0). Let 
us define the probability distribution to find the system 
with the values z\ and z 2 of the quadrature component 
observables Zy and Z 2 : 

P(z v ,z 2 ) = (y\8(z v - Z v )5(z 2 - Z 2 )|*> (11) 
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FIG. 1: Schematic set-up for the "quantum public key" based 
cryptography with continous variables 



After Eve's action the probability distribution becomes: 

Pe{zv,z 2 ) = (0\{9\W8(zv ~ Z v )8{z 2 - Z 2 )U\*)\0) 

(12) 

To avoid that Eve presence is revealed, both probability 
distributions must be equal for the particular values of 
9a and 9b chosen by Alice and Bob. On the other hand, 
Eve is vulnerable to detection, whenever there exist pos- 
sible choices o19a,9b (possible homodyne measurements 
made by Bob or Alice) for which the probability distri- 
bution of the measurement outcomes is changed by Eve's 
action. 

THEOREM : If Alice measures only one quadrature 
Zy, Eve attack is not vulnerable to a successive detection 
by Bob if and only if (v|Z7|0) is a function only of the 
quadrature operator Zy. 

PROOF: When (v\U\0) commutes with Zy then the 
?7's cancel each other in ([l2]) and trivially: 

P E ( Z y,Z 2 ) = P{zy,Z 2 ) (13) 

On the contrary, let us examine the consequence of re- 
quiring ( |l3|) for all possible choices of the quadrature Z 2 
measured by Bob but only for the state |^) given by (0). 
Taking the Fourier transform on z\ and z 2 , the equation 



(|l3| ) becomes: 

(0|{T'|?7 t e^ 1 ' Sl e^ 2S2 LT|^)|0) = (*|e iil,Sl e ii2S2 |#) 

(14) 

This equality should be satisfied for any value of the real 
parameters s\, s 2 , 9b- The last two can be replaced 
by the more global complex parameter £ = £x + — 
e l9B s 2 , in such a way that Z 2 s 2 — + £*a 2 - Let us 
introduce: 

T n ,n>(Z,Z*)= 2 {n'\e'<^ + ^^)\n) 2 (15) 

A calculation shows that for all occupation number n and 
n' of the beam 2: 

J ^r n ,„,(£,r)e l ^+ra 2 ) = | n ) 22 ( n /| ( i6) 

Applying this transformation to (|lj) and using the prop- 
erty of entanglement of ([j]), we eliminate the states de- 
scribing the second beam since U does not affect beam 2. 
We obtain for all occupation numbers n and n! for beam 
1: 

(0| 1 (n'|C/te^' 51 L/|n) 1 |0)= ^V^- 1 |n)i (17) 
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Operating the inverse transformation of the matrix ele- 
ment in the right hand side, we get: 



(0| 1 (n'\U^e i ^' ai Ue- i ^" 1 \n)i\Q) = 6 n 



(18) 



Without loss of generality we can write the explicit de- 
pendance of U on the observables associated to the first 
beam as U = U(Zy, Qy), where Qy — (aie~ l9A — 
a\e l6A )/i is the observable canonically conjugated to Zy. 
Noticing that the exponential operator is the generator of 
translations i.e. e l2 ^ Sl Q v e^^' Sl = Qy - 2s x , Eq.© 
becomes: 

(Q\x{n'\U\Z v ,Q v )U{Zv,Q v -2sx)\n)i\Q) =5 n ,, n 

(19) 

Because two normalized states with unity scalar product 
are necessarily equal, we infer that for all n: 

U{Z v ,Qv)\n)i\Q) = U{Zy,Qy-2s 1 )\n) 1 \0) (20) 

We conclude that, for any state \u), (u\U(Zy, Qy)\0) 
does not depend on Qy or equivalently it depends only 
on the quadrature operator Zy measured by Alice. 

COROLLARY: If Alice chooses to measure between 
at least two distinct and non opposite quadratures, Eve 
attack is not vulnerable if and only if U does not interact 
with the beam 1 and acts only onto the state |0) i.e.: 



(v\ 1 (n'\U\n) 1 \0)=6. 



(21) 



where u v does not depend on n. 

PROOF: From the theorem, we deduce that for each 
non opposite quadrature we must have the dependance 
U(Zy). Since the quadratures are independent, the only 
possibility is that U is independent of any observable 
relative to the beam 1 or is of the form @. 

One direct consequence of the theorem and its corol- 
lary is that if there is any element of randomness in the 
choice of the quadrature Zy made by Alice, then Eve 
cannot safely extract any information about beam 1 and 
therefore about the message. This element of random- 
ness can be introduced as a random choice between two 
distinct and non opposite values <pA- Alternatively the 
message itself can be a random sequence of phase shifts 
0, chosen at least between two distinct and non opposite 
values. Thus, Eve is also vulnerable in the case of a digi- 
tal transmission in which for example, Alice restricts her 
measurement to two orthogonal quadratures. 

The facts that the probability distributions must be 
equal for any value of #b, that the second beam has been 
kept private and that |^) has the entangled form (jl]) 
permits to achieve the proofs. If the value of 9b remains 



different and for example is a disentangled state, then 
the beam 1 might be cloned by Eve and therefore she 
can obtain information without being detected. 

The vulnerability of Eve does not mean that she will be 
necessarily detected by Bob. When Bob receives a mes- 
sage, how can he know a priori that eavesdropping has 
occured? For example, Eve can block Bob's public beam 
and can replace it with a public beam of her own. Alice 
proceeds as planned and sends the results of her measure- 
ment to both Bob and to Eve. Eve decrypts the correct 
message but Bob gets the wrong message. To avoid this 
situation, Bob must be able to check that some expected 
correlations are recovered. One possibility is the intro- 
duction of some redundancies in the message which can 
help him to detect the presence of the third party. For 
example, Alice sends twice portions of the message. Any 
external intervention is detected if two identical portions 
are not recovered. Therefore, a strategy of communi- 
cation or protocol is needed in order to guarantee the 
absolute security of the transmission. The study of such 
protocols requires further investigation and is beyond the 
scope of this letter. 

In summary, we developed a "quantum public key" 
scheme for encrypting a message by means of quantum 
correlated beams. This scheme is based on the principle 
that any decryption of the message requires both mea- 
surements of a "q-private" key signal and an encrypted 
"q-public" key signal. Directions for a future research 
work include, in addition to the study of secure protocols, 
the imperfection in the photon counting of the detector 
and the possibility of loss in the transmission which de- 
grades the correlations. 
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If Eve has access to the second beam, then the unitary 
operator depends also on ai and a 2 and the passage from 
( |l4| ) to (0) is not necessarily valid. Finally, if j*) is 
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